feat(ocsf): enrich middleware shorthand logs

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

crates/openshell-ocsf/src/format/shorthand.rs

@@ -7,7 +7,22 @@
 
 use crate::events::OcsfEvent;
 use crate::events::base_event::BaseEventData;
-use crate::objects::Url;
+use crate::objects::{Evidence, Url};
+
+fn finding_evidence_value<'a>(evidences: Option<&'a [Evidence]>, key: &str) -> Option<&'a str> {
+    evidences?
+        .iter()
+        .filter_map(|evidence| evidence.data.as_ref()?.as_object())
+        .find_map(|data| data.get(key)?.as_str())
+}
+
+fn message_bool_value<'a>(message: Option<&'a str>, key: &str) -> Option<&'a str> {
+    let prefix = format!("{key}=");
+    message?
+        .split_ascii_whitespace()
+        .find_map(|field| field.strip_prefix(&prefix))
+        .filter(|value| matches!(*value, "true" | "false"))
+}
 
 /// Format a timestamp (ms since epoch) as `HH:MM:SS.mmm`.
 ///
@@ -195,10 +210,32 @@ impl OcsfEvent {
                     .and_then(|r| r.url.as_ref())
                     .map(Url::to_display_string)
                     .unwrap_or_default();
+                let transformed = e
+                    .firewall_rule
+                    .as_ref()
+                    .filter(|rule| rule.rule_type == "middleware")
+                    .and_then(|_| message_bool_value(e.base.message.as_deref(), "transformed"));
+                let failed = e
+                    .firewall_rule
+                    .as_ref()
+                    .filter(|rule| rule.rule_type == "middleware")
+                    .and_then(|_| message_bool_value(e.base.message.as_deref(), "failed"));
                 let rule_ctx = e
                     .firewall_rule
                     .as_ref()
-                    .map(|r| format!(" [policy:{} engine:{}]", r.name, r.rule_type))
+                    .map(|r| {
+                        let mut context = vec![
+                            format!("policy:{}", r.name),
+                            format!("engine:{}", r.rule_type),
+                        ];
+                        if let Some(value) = transformed {
+                            context.push(format!("transformed:{value}"));
+                        }
+                        if let Some(value) = failed {
+                            context.push(format!("failed:{value}"));
+                        }
+                        format!(" [{}]", context.join(" "))
+                    })
                     .unwrap_or_default();
                 // For denied events, surface the reason from status_detail
                 let reason_ctx = if action == "DENIED" {
@@ -280,16 +317,26 @@ impl OcsfEvent {
             }
 
             Self::DetectionFinding(e) => {
-                let disposition = e
-                    .disposition
-                    .map_or_else(|| "UNKNOWN".to_string(), |d| d.label().to_uppercase());
+                let disposition = e.disposition.map_or_else(
+                    || e.base.activity_name.to_uppercase(),
+                    |d| d.label().to_uppercase(),
+                );
                 let title = &e.finding_info.title;
-                let confidence_ctx = e
-                    .confidence
-                    .map(|c| format!(" [confidence:{}]", c.label().to_lowercase()))
-                    .unwrap_or_default();
-
-                format!("FINDING:{disposition} {sev} \"{title}\"{confidence_ctx}")
+                let mut context = vec![format!("type:{}", e.finding_info.uid)];
+                if let Some(middleware) =
+                    finding_evidence_value(e.evidences.as_deref(), "middleware")
+                {
+                    context.push(format!("middleware:{middleware}"));
+                }
+                if let Some(count) = finding_evidence_value(e.evidences.as_deref(), "count") {
+                    context.push(format!("count:{count}"));
+                }
+                if let Some(confidence) = e.confidence {
+                    context.push(format!("confidence:{}", confidence.label().to_lowercase()));
+                }
+                let context = format!(" [{}]", context.join(" "));
+
+                format!("FINDING:{disposition} {sev} \"{title}\"{context}")
             }
 
             Self::ApplicationLifecycle(e) => {
@@ -534,6 +581,37 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_http_activity_shorthand_includes_middleware_outcome() {
+        let mut base = base(4002, "HTTP Activity", 4, "Network Activity", 99, "Other");
+        base.set_message(
+            "MIDDLEWARE prototype-content-guard example/content-guard decision=Allow transformed=false failed=true",
+        );
+        let event = OcsfEvent::HttpActivity(HttpActivityEvent {
+            base,
+            http_request: Some(HttpRequest::new(
+                "POST",
+                Url::new("http", "httpbin.org", "/anything", 443),
+            )),
+            http_response: None,
+            src_endpoint: None,
+            dst_endpoint: None,
+            proxy_endpoint: None,
+            actor: None,
+            firewall_rule: Some(FirewallRule::new("httpbin", "middleware")),
+            action: Some(ActionId::Allowed),
+            disposition: Some(DispositionId::Allowed),
+            observation_point_id: None,
+            is_src_dst_assignment_known: None,
+        });
+
+        let shorthand = event.format_shorthand();
+        assert_eq!(
+            shorthand,
+            "HTTP:POST [INFO] ALLOWED POST http://httpbin.org:443/anything [policy:httpbin engine:middleware transformed:false failed:true]"
+        );
+    }
+
     #[test]
     fn test_network_activity_shorthand_denied_shows_reason() {
         let mut b = base(4001, "Network Activity", 4, "Network Activity", 1, "Open");
@@ -863,8 +941,35 @@ mod tests {
         let shorthand = event.format_shorthand();
         assert_eq!(
             shorthand,
-            "FINDING:BLOCKED [HIGH] \"NSSH1 Nonce Replay Attack\" [confidence:high]"
+            "FINDING:BLOCKED [HIGH] \"NSSH1 Nonce Replay Attack\" [type:nssh1-replay-abc confidence:high]"
+        );
+    }
+
+    #[test]
+    fn test_detection_finding_shorthand_uses_activity_and_safe_evidence() {
+        let event = OcsfEvent::DetectionFinding(DetectionFindingEvent {
+            base: base(2004, "Detection Finding", 2, "Findings", 1, "Create"),
+            finding_info: FindingInfo::new("content_guard.match", "configured content matched"),
+            evidences: Some(vec![Evidence::from_pairs(&[
+                ("middleware", "prototype-content-guard"),
+                ("count", "1"),
+                ("matched_content", "must-not-appear"),
+            ])]),
+            attacks: None,
+            remediation: None,
+            is_alert: None,
+            confidence: None,
+            risk_level: None,
+            action: None,
+            disposition: None,
+        });
+
+        let shorthand = event.format_shorthand();
+        assert_eq!(
+            shorthand,
+            "FINDING:CREATE [INFO] \"configured content matched\" [type:content_guard.match middleware:prototype-content-guard count:1]"
         );
+        assert!(!shorthand.contains("must-not-appear"));
     }
 
     #[test]

docs/observability/logging.mdx

@@ -94,7 +94,7 @@ CLASS:ACTIVITY [SEVERITY] ACTION DETAILS [CONTEXT]
 - SSH: peer address and authentication type
 - Process: `name(pid)` with exit code or command line
 - Config: description of what changed
-- Finding: quoted title with confidence level
+- Finding: quoted title with the stable finding type, optional confidence, and allowlisted evidence fields when available
 
 **Context** in brackets at the end provides the policy rule and enforcement engine that produced the decision.
 
@@ -130,6 +130,13 @@ An HTTP request to a non-default port. HTTP log URLs include the port whenever i
 OCSF HTTP:GET [INFO] ALLOWED GET http://api.internal.corp:8080/v1/status [policy:internal_api engine:opa]
 ```
 
+A supervisor middleware HTTP event records whether it transformed the request. If the middleware also emits a finding, that remains a separate event:
+
+```text
+OCSF HTTP:POST [INFO] ALLOWED POST http://httpbin.org:443/anything [policy:httpbin engine:middleware transformed:true failed:false]
+OCSF FINDING:CREATE [MED] "configured content matched" [type:content_guard.match middleware:prototype-content-guard count:1]
+```
+
 Proxy and SSH servers ready:
 
 ```text